Landmark studies* by the Ponemon Institute estimate the average cost of medical identity theft per victim is $20,663.
Victims first learn about the medical identity theft upon
- receipt of a collection letter (46%)
- discovery of a mistake in health records (30%),
- a drop in credit score (16%),
- an alert from a healthcare provider (9%),
- errors posted to medical invoices (9%), or, least likely,
- a data breach notification (5%).
Consequences are far ranging beginning with:
- out-of-pocket payments (50%),
- termination by plan or provider (49%),
- increased insurance premiums (33%),
- time lost to correct errors (24%),
- diminished credit score (19%),
- mistreatment or misdiagnosis of illness (18% and 10%), and
- legal fees (14%).
An estimated 1.49 million Americans were affected by medical identity theft in 2011 for a national impact of $30.9 billion.
In instances where there has been a data breach rather than an individual theft, the cause is most usually
- a lost or stolen computing device (49%) followed by
- a third-party mistake—perhaps by a business associate (46%), and
- an unintentional employee action (41%).
A data breach caused by a
- criminal attack (30%) or
- malicious insider (14%)
is much less likely.
Data breaches are most likely to be detected by
- an employee (51%), followed by
- an audit/assessment (43%) or
- a patient complaint (35%).
Once a breach is detected, it takes an average of seven weeks to notify affected patients despite the widespread belief that it is critical to notify victims as soon as possible.
*All statistics cited are from the Ponemon Institute's Second Annual Survey on Medical Identity Theft, a survey of adult-aged individuals (March 2011), or the Study on Patient Privacy and Data Security, a survey of hospitals and healthcare organizations (December 2011).